What the Brexit deal means for your UK data transfers

Until recently the position in relation to personal data transfers from the EEA to the UK from 1 January 2021 had been unclear. Many businesses have been preparing for a no deal scenario whereby the UK would become a third country under GDPR and additional safeguards would be required. This included incorporating Standard Contractual Clauses into data processing and data sharing contracts. 

The UK have now agreed a deal with the EU which addresses this issue. In accordance with the Trade and Cooperation Agreement transfers of personal data to the UK will not be considered transfers to a third country. 

This means that the status quo remains and transfers to the UK can continue as normal without the need for Standard Contractual Clauses or other safeguards. This position applies for the next 4 months (with a possible extension to 6 months) or until an adequacy decision is made (whichever is earlier).  

The intention of the EU Commission is to adopt an adequacy decision within the next 4-6 months. The effect of an adequacy decision is that personal data can flow from the EEA to the UK without the need for any further safeguards.

Should no adequacy decision be made it will again become necessary for businesses to implement additional safeguards where personal data is transferred to the UK.

.

We will continue to keep you posted on updates in relation to international data transfers and Standard Contractual Clauses. For further information or advice, please contact Seán O’Donnell, Aislinn Cullen or any member of the ByrneWallace LLP Data Protection/ GDPR Team.